CVE-2025-9515 is an unrestricted file upload vulnerability (CWE-434) in the Multi Step Form WordPress plugin by mondula2016. The issue arises from inadequate validation of file types during the import process, allowing users with Administrator privileges to upload arbitrary files. This can potentially enable remote code execution on the hosting server. The vulnerability affects all plugin versions up to 1.7.25. The CVSS 3.1 base score is 7.2, indicating high severity. No patch or official fix details are currently available, and the plugin is not a cloud service, so remediation depends on vendor updates or user action.

An attacker with Administrator-level access can upload arbitrary files to the server hosting the WordPress site via the vulnerable import functionality. This can lead to remote code execution, compromising confidentiality, integrity, and availability of the affected system. The vulnerability is rated high severity (CVSS 7.2) due to the potential for full system compromise. No known exploits have been reported in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix is currently available, administrators should restrict plugin usage to trusted users only and consider disabling or removing the Multi Step Form plugin until a fix is released. Monitor vendor channels for updates and apply any official patches promptly once available.